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AMENDMENTS TO THE CLAIMS 

In the Notice of Allowance mailed September 11, 2009, claims 1-2, 4-8, 10-11, 
13-17, 19-26, 28-35, and 37-44 have been allowed. Claims 1, 5, 10, 14, 19, 20, 23, 28, 29, 34, 
38, and 42 are amended herein to correct minor grammatical errors. This listing of claims will 
replace all prior versions, and listings, of claims in the application: 

Listing of Claims: 

1 . (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a method for monitoring a 
process, the method comprising: 

creating a signature representative of the process; 

continuously updating the created signature with a weighting scheme; and 
detecting abnormalities based upon the continuously[[~]]_updated 
signature, 

wherein the process is related to usage of networked computing devices in 
a datacenter, 

wherein the signature includes information related to time[[-]]-sensitive 
averaging that accounts for variation in a business cycle, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously[[-]]_updated signature weight and a second weighting 
factor that represents a current data weight, 
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wherein creating a signature comprises accelerated learning through 
setting a learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 
[[.]] 

2. (Previously Presented) The media of claim 1, wherein creating a 
signature comprises calculating an average and a standard deviation. 

3. (Canceled). 

4. (Previously Presented) The media of claim 2, wherein creating a 
signature comprises initially repeating a running average and standard deviation through a 
plurality of intervals. 

5. (Currently Amended) The media of claim 1, wherein updating the created 
signature comprises ensuring that recently[[-]]_recorded data has a greater impact than older data 
by setting the second weighting factor to a value greater than the first weighting factor. 

6. (Previously Presented) The media of claim 1, wherein updating the 
created signature comprises utilizing a moving average over a time to account for events 
occurring at unexpected times. 

7. (Previously Presented) The media of claim 1, wherein detecting 
abnormalities comprises determining if measured values are above an upper threshold or below a 
lower threshold. 
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8. (Previously Presented) The media of claim 1, further comprising 
calculating upper and lower threshold limits based on jitter offset. 

9. (Canceled). 

10. (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a method for detecting 
abnormalities occurring during a process based upon a continuously updated signature 
representative of the process, the method comprising: 

creating a signature representative of the process[[,]]; 

continuously updating the created signature with a weighting scheme; 

continuously monitoring a system parameter; 

computing a normal range of values for the system parameter based on the 
continuously[[-]]_updated signature; 

determining if the monitored system parameter is within the normal range; 

and 

indicating existence of an abnormality if the monitored system parameter 
is outside of the normal range, 

wherein the process is related to usage of networked computing devices in 
a datacenter, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously[[-]]_updated signature weight and a second weighting 
factor that represents a current data weighs 
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wherein creating a signature comprises accelerated learning through 
setting a learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 

11. (Previously Presented) The media of claim 10, further comprising 
creating a signature by calculating an average and a standard deviation. 

12. (Canceled). 

13. (Previously Presented) Thejnedia of claim 11, wherein creating a 
signature comprises initially repeating the running average and standard deviation through a 
plurality of intervals. 

14. (Currently Amended) The media of claim 10, wherein computing a 
normal range of values comprises ensuring that recently[[-]]_recorded data has a greater impact 
than older data by setting the second weighting factor to a value greater than the first weighting 
factor. 

15. (Previously Presented) The media of claim 10, wherein computing a 
normal range of values comprises utilizing a moving average over a time to account for events 
occurring at unexpected times. 

16. (Previously Presented) The media of claim 10, wherein determining 
whether a monitored system parameter is within a normal range of values comprises determining 
if monitored system parameters are above an upper threshold or below a lower threshold. 
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17. (Previously Presented) The media of claim 16, further comprising 
calculating upper and lower threshold limits based on jitter offset. 

18. (Canceled). 

19. (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a method for creating a 
signature useful for detecting abnormalities in a computing system environment, the method 
comprising: 

setting a learning responsiveness ratio; 
monitoring a system parameter; 

adjusting the learning responsiveness ratio at fixed intervals until a desired 
value is reached; 

calculating an average and standard deviation for each interval; and 
using the average, standard deviation and learning responsiveness ratio to 

create the signature, 

wherein the learning responsiveness ratio is equated to a weighting factor 

that represents current data divided by a weighting factor that represents the 

signature, 

wherein the abnormalities in the computing system environment relate to 
usage of networked computing devices in a datacenter, and 

wherein the signature includes information related to time[[-]]-sensitive 
averaging that accounts for variation in a business cycle. 
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20. (Currently Amended) The media of claim 19, further comprising 
continuously updating the created signature through a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously[[-]]_updated signature weight and a second weighting 
factor that represents a current data weight. 

21. (Previously Presented) The media of claim 20, further comprising 
detecting abnormalities based on the updated signature. 

22. (Previously Presented) The media of claim 19, wherein creating a 
signature comprises initially repeating the running average and standard deviation through a 
plurality of intervals. 

23. (Currently Amended) The media of claim 20, wherein updating the 
created signature comprises ensuring that recently[[-]]_recorded data has a greater impact than 
older data by setting the second weighting factor to a value greater than the first weighting 
factor. 

24. (Previously Presented) The media of claim 20, wherein updating the 
created signature comprises utilizing a moving average over a time to account for events 
occurring at unexpected times. 

25. (Previously Presented) The media of claim 21, wherein detecting 
abnormalities comprises determining if measured values are above an upper threshold or below a 
lower threshold. 
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26. (Previously Presented) 



The media of claim 21, further comprising 



calculating upper and lower threshold limits based on jitter offset. 



27. (Canceled). 

28. (Currently Amended) A computerized system including computer storage 



media for detecting abnormal activity in a computerized environment, the system comprising: 



monitoring tools stored on the computer storage media for continuously 
monitoring a system parameter; 

a continuously updated signature representative of typical values of the 
system parameter ; and 

an abnormality indicator calculated based on the continuously updated 
signature, the abnormality indicator including a range of typical values for the 
system parameter, 

wherein the signature is continuously updated with a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor 
representing the weight of the continuously[[-]]_updated signature and a second 
weighting factor representing the weight of current data, 

wherein the abnormal activity is related to abnormal usage of networked 
computing devices in a datacenter, 

wherein the signature includes information related to time[[-]]-sensitive 
averaging that accounts for variation in a business cycle,, 

wherein the signature is created by accelerated learning through setting a 
learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
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value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 

29. (Currently Amended) The system of claim 28, wherein the 
continuously[[-]]_updated signature comprises an average and a standard 

deviation. 

30. (Previously Presented) The system of claim 28, wherein the continuously 
updated signature comprises the second weighting factor having a greater value than the first 
weighting factor to ensure that recently recorded data has a greater impact than older data. 

31. (Previously Presented) The system of claim 28, wherein the continuously 
updated signature comprises a moving average over time to account for events occurring at 
unexpected times. 

32. (Original) The system of claim 28, wherein the abnormality indicator 
determines whether a monitored system parameter is within a normal range of values and 
whether monitored system parameters are above an upper threshold or below a lower threshold. 

33. (Original) The method of claim 28, wherein the abnormality indicator 
calculates upper and lower threshold limits based on jitter offset. 

34. (Currently Amended) A computerized monitoring system including one or 
more computer storage media for monitoring a process, the monitoring system comprising: 

a signature creation module, stored on the one or more computer storage 
media, for creating a signature representative of the process; 
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a signature updating module, stored on the one or more computer storage 
media, for continuously updating the created signature; and 

an abnormality detection module, stored on the one or more computer 
storage media, for detecting abnormalities based upon deviations from the 
updated signature, 

wherein the signature is continuously updated with a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously[[-]]_updated signature weight and a second weighting 
factor that represents a current data weight, 

wherein the signature creation module comprises tools for performing 
accelerated learning through incrementally increasing a learning responsiveness 
ratio until the learning responsiveness ratio reaches a desired value, 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor, 

wherein the process is carried out on a computer and is related to usage of 
networked computing devices in a datacenter, and 

wherein the signature includes information related to time[[ ]] z sensitive 
averaging that accounts for variation in a business cycle. 

35. (Original) The system of claim 34, wherein the signature creation module 
includes tools for calculating an average and a standard deviation. 

36. (Canceled). 

37. (Original) The system of claim 35, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 
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38. (Currently Amended) The system of claim 34, wherein the signature 
updating module comprises tools for ensuring that recently[[-]]_recorded data has a greater 
impact than older data by setting the second weighting factor to a value greater than the first 
weighting factor. 

39. (Original) The system of claim 34, wherein the signature updating module 
comprises tools for calculating a moving average over a time to account for events occurring at 
unexpected times. 

40. (Original) The system of claim 34, wherein the abnormality detection 
module determines if monitored system parameters are above an upper threshold or below a 
lower threshold. 

41. (Original) The method of claim 34, wherein the abnormality detection 
module includes a mechanism for calculating upper and lower threshold limits based on jitter 
offset. 

42. (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a method for distinguishing 
between normal and abnormal behavior during a process, the method comprising: 

creating a signature representative of the process[[,]]; 

continuously updating the created signature with a weighting scheme; 

monitoring a system parameter; 

converting a numeric data stream representative of the monitored system 
parameter to a state for the process; and 

distinguishing between normal and abnormal behavior based on the state, 
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wherein the process is related to usage of networked computing devices in 
a datacenter, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously[[-]]_updated signature weight and a second weighting 
factor that represents a current data weight, 

wherein the system parameter includes at least one of a usage variable, 
utilization, an error, and turn[[ ]]around time, 

wherein distinguishing between normal and abnormal behavior includes 
utilizing time[[ ]] z sensitive averaging to account for variation in a business cycle.! 

wherein the signature is created by accelerated learning through setting a 
learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 

43. (Previously Presented) The media of claim 42, further comprising 
converting the numeric data streams to multiple sub-states. 

44. (Previously Presented) The media of claim 42, further comprising 
determining a root cause of an abnormality based on the state. 
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